From 55989cbc0e1712543f974d5b8f4a3b4ac00cffa2 Mon Sep 17 00:00:00 2001
From: Christian Dullweber <dullweber@chromium.org>
Date: Wed, 13 May 2026 03:39:20 -0700
Subject: [PATCH] PageInfo: Avoid potential UaF in security controller

Set native pointer to 0 after destruction and check pointer for
resetCertDecision() callback.

Bug: 502714977
Change-Id: I011d5244c055833b9df3f35623305cb6432f80b1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7816724
Auto-Submit: Christian Dullweber <dullweber@chromium.org>
Commit-Queue: Christian Dullweber <dullweber@chromium.org>
Reviewed-by: Emily Stark <estark@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1629868}
---

diff --git a/components/page_info/android/java/src/org/chromium/components/page_info/PageInfoConnectionSecurityController.java b/components/page_info/android/java/src/org/chromium/components/page_info/PageInfoConnectionSecurityController.java
index 909af6e..60d84fc 100644
--- a/components/page_info/android/java/src/org/chromium/components/page_info/PageInfoConnectionSecurityController.java
+++ b/components/page_info/android/java/src/org/chromium/components/page_info/PageInfoConnectionSecurityController.java
@@ -29,7 +29,7 @@
     private final PageInfoRowView mRowView;
     private @Nullable ConnectionSecurityView mActiveView;
     private final ConnectionSecurityView.ViewParams mViewParams;
-    private final long mNativeConnectionSecurityController;
+    private long mNativeConnectionSecurityController;
 
     public PageInfoConnectionSecurityController(
             PageInfoMainController mainController,
@@ -75,6 +75,8 @@
     }
 
     private void loadIdentityInfo() {
+        if (mNativeConnectionSecurityController == 0) return;
+
         PageInfoConnectionSecurityControllerJni.get()
                 .loadIdentityInfo(mNativeConnectionSecurityController);
     }
@@ -141,6 +143,8 @@
     public void updateSubpageIfNeeded() {}
 
     public void resetCertDecision() {
+        if (mNativeConnectionSecurityController == 0) return;
+
         PageInfoConnectionSecurityControllerJni.get()
                 .resetCertDecisions(mNativeConnectionSecurityController);
         mMainController.dismiss();
@@ -148,6 +152,7 @@
 
     public void destroy() {
         PageInfoConnectionSecurityControllerJni.get().destroy(mNativeConnectionSecurityController);
+        mNativeConnectionSecurityController = 0;
     }
 
     @NativeMethods